Your user account does not have permanently "active" administration privileges.
All actions that require elevated privileges require you to enter your password. If you weren't an administrator, you'd need to enter an administrator's user name and password instead.
These actions include:
- Modifying or setting permissions on files and folders you don't own or have sufficient permissions to
- Installing applications that require
root privileges somewhere along the line (e.g. for driver installation)
- Changing any of the system preferences
- Executing command-line utilities with elevated privileges
Without entering your own account's password, you can do nothing that requires elevated privileges.
What appears to be "automatic privileges", such as the ability to write to
/Applications, is realized using group memberships. Your admin account is a member of the
admin groups, and
/Applications is group-writeable for members of the
admin group. Very few locations in the system have privileges like these. Here, it's simply a convenience feature.
The difference between having one admin account, or a primary, regular account and a secondary admin account are basically the permissions you lose by missing out on some group memberships, and slightly more hassle with granting administrator privileges both in the GUI and on the command-line (
sudo doesn't work anymore, as you're not a member of